diff --git a/boot/espressif/hal/src/esp32/app_cpu_start.c b/boot/espressif/hal/src/esp32/app_cpu_start.c
new file mode 100644
index 0000000..c465f7d
--- /dev/null
+++ b/boot/espressif/hal/src/esp32/app_cpu_start.c
@@ -0,0 +1,38 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "app_cpu_start.h"
+
+#include "soc/dport_reg.h"
+#include "soc/gpio_periph.h"
+#include "soc/rtc_periph.h"
+#include "soc/rtc_cntl_reg.h"
+#include "esp32/rom/cache.h"
+#include "esp32/rom/uart.h"
+#include "esp_cpu.h"
+#include "esp_log.h"
+
+static const char *TAG = "app_cpu_start";
+
+void appcpu_start(uint32_t entry_addr)
+{
+    ESP_LOGI(TAG, "Starting APPCPU");
+
+    Cache_Flush(1);
+    Cache_Read_Enable(1);
+
+    esp_cpu_unstall(1);
+
+    DPORT_SET_PERI_REG_MASK(DPORT_APPCPU_CTRL_B_REG, DPORT_APPCPU_CLKGATE_EN);
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_APPCPU_CTRL_C_REG, DPORT_APPCPU_RUNSTALL);
+    DPORT_SET_PERI_REG_MASK(DPORT_APPCPU_CTRL_A_REG, DPORT_APPCPU_RESETTING);
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_APPCPU_CTRL_A_REG, DPORT_APPCPU_RESETTING);
+
+    ets_set_appcpu_boot_addr(entry_addr);
+    ets_delay_us(10000);
+    uart_tx_wait_idle(0);
+    ESP_LOGI(TAG, "APPCPU start sequence complete");
+}
diff --git a/boot/espressif/hal/src/flash_encrypt.c b/boot/espressif/hal/src/flash_encrypt.c
index 237eca7..77f5992 100644
--- a/boot/espressif/hal/src/flash_encrypt.c
+++ b/boot/espressif/hal/src/flash_encrypt.c
@@ -234,7 +234,7 @@
      * This will need changes when implementing multi-slot support
      */
     ESP_LOGI(TAG, "Encrypting remaining flash...");
-    uint32_t region_addr = CONFIG_ESP_APPLICATION_SECONDARY_START_ADDRESS;
+    uint32_t region_addr = CONFIG_ESP_IMAGE0_SECONDARY_START_ADDRESS;
     size_t region_size = CONFIG_ESP_APPLICATION_SIZE;
     err = esp_flash_encrypt_region(region_addr, region_size);
     if (err != ESP_OK) {
@@ -247,6 +247,21 @@
         return err;
     }
 
+#if defined(CONFIG_ESP_IMAGE_NUMBER) && (CONFIG_ESP_IMAGE_NUMBER == 2)
+    region_addr = CONFIG_ESP_IMAGE1_PRIMARY_START_ADDRESS;
+    region_size = CONFIG_ESP_APPLICATION_SIZE;
+    err = esp_flash_encrypt_region(region_addr, region_size);
+    if (err != ESP_OK) {
+        return err;
+    }
+    region_addr = CONFIG_ESP_IMAGE1_SECONDARY_START_ADDRESS;
+    region_size = CONFIG_ESP_APPLICATION_SIZE;
+    err = esp_flash_encrypt_region(region_addr, region_size);
+    if (err != ESP_OK) {
+        return err;
+    }
+#endif
+
 #ifdef CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
     // Go straight to max, permanently enabled
     ESP_LOGI(TAG, "Setting CRYPT_CNT for permanent encryption");
@@ -309,20 +324,20 @@
     /* Check if the slot is plaintext or encrypted, 0x20 offset is for skipping
      * MCUboot header
      */
-    err = bootloader_flash_read(CONFIG_ESP_APPLICATION_PRIMARY_START_ADDRESS + 0x20,
+    err = bootloader_flash_read(CONFIG_ESP_IMAGE0_PRIMARY_START_ADDRESS + 0x20,
                                 &img_header, sizeof(esp_image_load_header_t), true);
     if (err != ESP_OK) {
         ESP_LOGE(TAG, "Failed to read slot img header");
         return err;
     } else {
-        err = verify_img_header(CONFIG_ESP_APPLICATION_PRIMARY_START_ADDRESS,
+        err = verify_img_header(CONFIG_ESP_IMAGE0_PRIMARY_START_ADDRESS,
                                 &img_header, true);
     }
 
     if (err == ESP_OK) {
         ESP_LOGI(TAG, "Encrypting primary slot...");
 
-        err = esp_flash_encrypt_region(CONFIG_ESP_APPLICATION_PRIMARY_START_ADDRESS,
+        err = esp_flash_encrypt_region(CONFIG_ESP_IMAGE0_PRIMARY_START_ADDRESS,
                                        CONFIG_ESP_APPLICATION_SIZE);
         if (err != ESP_OK) {
             ESP_LOGE(TAG, "Failed to encrypt slot in place: 0x%x", err);